The following table sets out the recommendations from the TNA Information Management Assessment undertaken in June 2009 and shows the Actions, Priority and Timescale in which DfT have already or plan to take the necessary actions.

| # | Recommendation | Actions | Priority | Timescale | Owner | Observations | Delivered? | |----|--------------------------------------------------------------------------------|-------------------------------------------------------------------------|----------|-----------|--------------------------------------------|----------------------------------------------------------------------------|------------| | R1 | The Department should develop a mechanism to measure its KIM performance. Guidance should be sought from the Government’s Knowledge Council. | 1.1 Develop outline matrix of measures to use to assess improved performance on KIM activities.\
1.2 Consult the Knowledge Council and others on best practice and identify examples used effectively in comparable organisations\
1.3 Implement effective performance measurement | Medium | 2010-11 | Knowledge & Information Management Division | It will be essential to measure our progress and effectiveness. | No | | R2 | The Department should formally identify a records and information management champion and strategic lead at Board level. | | High | Immediate | Knowledge & Information Management Division | The DfT’s Senior Information Risk Owner has incorporated the role within his overall responsibility for Information. | Yes – fully implemented in 2009 | | R3 | The Department should closely align its IT and KIM strategies to ensure cohesion and consistency | 3.1 Review both IM and ICT strategies to identify and make explicit the linkages | Medium | In 2010-11 | Information Management Directorate | We will explore how we can make more explicit linkages in future. | No | | R4 | The Department should identify and assess information management risks across the board, including high risks on the corporate risk register as necessary. | 4.1 Review the Corporate and Information Management risk registers | High | Immediate | Knowledge & Information Management Division | We fully recognise that inadequate information management contributes to information risk and that this needs to be fully reflected in the risk register. | Yes | | # | Recommendation | Actions | Priority | Timescale | Owner | Observations | Delivered? | |----|--------------------------------------------------------------------------------|-------------------------------------------------------------------------|----------|-----------|--------------------------------------------|------------------------------------------------------------------------------|------------| | R5 | The Department should assess what information has business value and should be kept. This guidance should then be disseminated to staff. | 5.1 Review existing RM guidance and improve with specific examples of material that needs to be kept and of what ephemeral information we should discard. | Medium | In 2010-11 | Knowledge & Information Management Division | Although we have generic examples of what must be kept as records e.g. ministerial submissions, decision letters, and legal advice, it is also for business unit to consider if other types information that they handle should also be within their business records. | No | | R6 | Records experts, including those in CLG, should contribute to the development of the new KIM strategy. | 6.1 Establish a programme of regular meetings with CLG colleagues to share concerns and seek expert advice. | High | Immediate | Knowledge & Information Management Division | RM policy and guidance continues to be a key element of the SLA for services from CLG to DfT, and is now directly managed by KIM Division. | Yes | | R7 | The Department should work closely with The National Archives in developing Departmental policy on what to keep. | 7.1 As part of the KIM responsibilities, establish good relations with TNA and channels to use to obtain advice. | High | Medium | Knowledge & Information Management Division | Related to Action 5 above. A summary of the DfT Records Management Policy was published on the DfT website in February. | No | | R8 | The Department should identify a lead on information management to champion the strategy on what to keep and ensure successful implement of the future KIM strategy. | 8.1 Set clear objectives for IMD Deputy Director to develop KIM strategy and lead on work-streams | High | Immediate | Knowledge & Information Management Division | The head of Knowledge and Information Management Division leads on the Better RM Project and wider KIM strategy work streams. | Yes | | # | Recommendation | Actions | Priority | Timescale | Owner | Observations | Delivered? | |----|--------------------------------------------------------------------------------|-------------------------------------------------------------------------|----------|-----------|--------------------------------------------|------------------------------------------------------------------------------|------------| | R9 | Once the Department has identified what information has business value, the Department should review if file plans are the most suitable means of capture for this information. | 9.1 Assess what additional facilities are necessary to improve access and use and identify how current/additional IT can be provided to meet these needs | Medium | In 2010-11 | Knowledge & Information Management Division | This action is Included in the Better RM project. | No | | R10| The Department should review the risk of not having size limits on staff inboxes and investigate alternative means of capture for emails. | 10.1 Review the operational efficiency of the Outlook Archive\
10.2 Assess whether additional management is needed to weed out ephemeral emails | Medium | In 2010-11 | Information Management Directorate | Size limits on email accounts were introduced in 2004 ahead of FOI and led to fewer emails being held by individual members of staff. This and other options for managing email will be considered following the Better RM project. | No | | R11| The Department should review the role of BRO to raise its profile and remit. | 11.1 Develop job role specification and objective for BROs\
11.2 Include in Better RM project roll-out | Medium | In 2010-11 | Knowledge & Information Management Division | Raising the profile of Business Records Officers and providing training are key elements of the current Better RM project | No | | R12| The Department should consider professionalising the role of the BRO in conjunction with the guidance provided by the Government Knowledge Council. | 12.1 Identify range of responsibilities that comprise the BRO and potentially wider business information manager role(s)\
12.2 Assess the scope for suitable professional training in line with Knowledge Council guidance | Medium | In 2010-11 | Knowledge & Information Management Division | We will assess the need for relevant training and achievement of professional qualifications for BROs in line with the Knowledge Council advice. | No |

Signed: \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_ \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_ \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\
Department IMA Team Information Management Consultant | # | Recommendation | Actions | Priority | Timescale | Owner | Observations | Delivered? | |----|--------------------------------------------------------------------------------|-------------------------------------------------------------------------|----------|-------------|--------------------------------------------|------------------------------------------------------------------------------|------------| | R13| The Department should take ownership of the BRO network to demonstrate its commitment to effective information management. | 13.1 Build on the initial steps taken in the Better RM project to engage and enthuse the BRO network | Medium | In 2010-11 | Knowledge & Information Management Division | KIM has assumed management of the BRO network | Yes | | R14| The Department should increase the frequency of BRO seminars and their scope to reinforce corporate information management messages across the network. | 14.1 Organise series of BRO seminars to engage with post holders and share best practice\
14.2 Explore use of intranets etc to use as communication tools between seminars | Medium | In 2010-11 | Knowledge & Information Management Division | The Better RM Project will provide an opportunity to engage with all BROs and seminars will be arranged quarterly in future. | No | | R15| The Department should review its retention periods and investigate an automated process for their application. | 15.1 Assess current policies and practice for both paper and electronic records\
15.2 Identify whether there is scope to rationalise the range of retention periods\
15.3 Explore how current IT can automate deletion of sets of electronic records at the appropriate time | Medium | In 2010-11 | Knowledge & Information Management Division | The Better RM project will include reviews of current AFPs and policies and procedures on retention. | No | | R16| Department should review the methods for protecting information held on AFPs to ensure that unauthorised access is not possible. | 16.1 Review and improve existing instructions for BROs to set AFP access rights\
16.2 Include step by step guidance in BRO Toolkit\
16.3 Include in BRO training course | Medium | In 2010-11 | Knowledge & Information Management Division | This is an important part of the improvements to the BRO responsibilities and skill set. | No | | R17| Private Office to undertake an annual assessment of procedures to fully comply with Cabinet Office and The National | 17.1 Agree necessary steps with senior Private Office management\
17.2 Include in the Better RM project so that all Directors fully recognise their responsibility to | Medium | In 2010-11 as part of Better RM project\
For review in July 2011 and | Head of Private Office | The relevant business unit rather than the Private Offices hold all business records in line with approved | Partially |

Signed: \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_ \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_ \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\
Department IMA Team Information Management Consultant | # | Recommendation | Actions | Priority | Timescale | Owner | Observations | Delivered? | |----|--------------------------------------------------------------------------------|-------------------------------------------------------------------------|----------|-----------|------------------------------|------------------------------------------------------------------------------|------------| | | Archives Guidance on Private Office records. | maintain full records on engagements with private office | | annually thereafter | Cabinet Office rules. | | | | R18| The Department should assess the risks relating to the hosting of DfT websites by third parties to ensure that they are managed effectively. | 18.1 Rationalise remaining third party hosted websites | Medium | 2009-10 | Communications Directorate | The corporate website platform is currently going through the technical/security accreditation process. On completion several campaign and micro sites will be moved to the central hosting platform. | Partially | | R19| The Department should develop a policy around the creation of websites to ensure the DfT Web team are involved from the outset. | 19.1 Maintain ban on new websites and domains unless expressly permitted by Cabinet Office | Medium | 2009-10 | Communications Directorate | The Service transformation and web rationalisation programme within DfT has helped to identify and subsequently reduce the number of DfT websites. | Yes | | R20| The Department should assess the risks relating to the publication of third party material on external websites in order to reassure DfT that it is not infringing intellectual property rights. | 20.1 Develop clear guidance to highlight the risks through inadvertently infringing Copyright when publishing 3rd party material on websites | Medium | 2009-10 | Communications Directorate | This is will be included in the Social Media Use Policy | No | | R21| The Department should consider whether material produced on Twitter is critical to keep for the public and policy record and, if so, how it should be captured. | 21.1 Develop clear guidance to highlight the need to consider information disclosed via Twitter and similar channels as potentially part of the official DfT record websites | Medium | In 2010-11 | Knowledge & Information Management Division | This will be included in the Social Media Use Policy and guidance. | No |

Signed: \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_ \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_ \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\
Department IMA Team Information Management Consultant | # | Recommendation | Actions | Priority | Timescale | Owner | Observations | Delivered? | |----|--------------------------------------------------------------------------------|-------------------------------------------------------------------------|----------|-----------|------------------------------|------------------------------------------------------------------------------|------------| | R22| The Department should consider design improvements for their website to ensure joined-up content and interlinking between policy areas. | 22.1 Complete development of revised website home page and top level structure | Medium | 2009-10 | Communications Directorate | There is ongoing work with policy and strategic communication colleagues to develop a revised home page and top level modal and pan-transport pages. | No | | R23| The Department should identify content owners for all material on the corporate website. | 23.1 Complete log of owners of material published on website | Medium | 2009-10 | Communications Directorate | The current ongoing content review has helped to establish content owners across the Department. | Yes | | R24| The Department should ensure that it is adhering to the COI guidelines on ‘Managing URLs’ and ‘Archiving Websites’ to ensure compliance. | 24.1 Include compliance with COI guidelines in annual management review | Medium | 2009-10 | Communications Directorate | COI guidelines to ensure web continuity are being followed for the corporate site and centrally managed DfT sites. | Yes | | R25| The Department should investigate the possibility of a protective marking prompt when saving documents to reinforce good practice. | | | | Information Management Directorate | This will be included in the Better RM project to identify areas where this facility would be an advantage. | No | | R26| The Department should increase awareness of protective marking procedures through training and the provision of clear and usable guidance. | 26.1 Include specific explanations of protect marking procedures in the mandatory Protecting Information refresher course for delivery in 2010 | | | Information Management Directorate | The Protecting Information e-Learning courses and associated guidance recently delivered to all staff highlighted the importance of properly assigning security markings, and will be repeated | Partially |

Signed: \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_ \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_ \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_ Department IMA Team Information Management Consultant | # | Recommendation | Actions | Priority | Timescale | Owner | Observations | Delivered? | |----|--------------------------------------------------------------------------------|-------------------------------------------------------------------------|----------|-----------|--------------------------------------------|------------------------------------------------------------------------------|------------| | | | | | | | | | | R27| The classification of a document should be included in the document's title so it is visible to users. This could be achieved through an automated process. | 27.1 Include as best practice in the Better RM project\
27.2 Investigate scope for implementing as an automatic prompt at document creation | | | Information Management Directorate | This is potentially an alternative to including the marking prominently at the top of each page of a document. | No | | R28| Information management training, in conjunction with information assurance, should become mandatory as part of the induction process. | 28.1 Assess whether the Better RM project delivers effective induction training by BROs for each new joiner in business areas | | | Information Management Directorate | The e-Learning Level 1 course is mandatory for all new staff within 1 month of joining (and sooner for posts regularly handling sensitive material). The BRO role is being enhanced to include providing IA/IM training for new joiners locally in a similar timescale. | Partially | | R29| The Department should assess the need for information management training to be included in information assurance training for general staff. | 29.1 Assess scope for additional training following completion of the Better RM project. | | | Information Management Directorate | We will be analysing feedback from during the roll-out of the Better RM project to assess the need for and scope of a general IM training course to supplement the role of BROs to support their colleagues and encourage best IM practices. | | | # | Recommendation | Actions | Priority | Timescale | Owner | Observations | Delivered? | |----|--------------------------------------------------------------------------------|------------------------------------------------------------------------|----------|-----------|------------------------------|------------------------------------------------------------------------------|------------| | R30| The Department should devise a process for reviewing intranet content to ensure that it is up to date. | 30.1 Complete review of intranet content. | Medium | In 2010-11 | Communications Directorate | There is a comprehensive review underway in preparation for the new content management system | Partially | | R31| The Department should review what other intranet content needs to be captured for the formal record to ensure critical business information is not lost. | 31.1 Include reminder of line sponsor responsibility for records management in communications at launch of new Transnet and in content publishing process documentation. | Medium | In 2010-11 | Communications Directorate | Any intranet content that is required as critical business information is the responsibility of the policy unit originating the material and should be kept as part of their records within their AFP. | | | R32| The Department should review the number of Localnets to ensure that there is more local access to allow the easier dissemination of content and sharing of information. | 32.1 Promote facility for Localnets in launch of new Transnet. | Medium | In 2010-11 | Communications Directorate | The Transnet managers train colleagues as “devolved publishers” as long as they are prepared to maintain Transnet editorial standards. | | | R33| The Department should undertake a digital continuity risk assessment within twelve months of the publication of this report in conjunction with The National Archives | 33.1 Plan for undertaking a digital continuity risk assessment in line with TNA guidance. | Medium | In 2010-11 | Information Management Directorate | IMD are working with TNA and other departments on developing guidance on assessing the risks of digital obsolescence and the steps necessary to maintain access to and use of data. | | | R34| The Department should develop a programme to increase awareness of effective information | 34.1 Include specific communications for middle management grades in Better RM roll-out. | Medium | In 2010-11 | Knowledge & Information Management Division | The Better RM project will include communications and guidance for all | |

Signed: \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_ \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_ \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\
Department IMA Team Information Management Consultant | # | Recommendation | Actions | Priority | Timescale | Owner | Observations | Delivered? | |----|----------------|---------|----------|-----------|-------|--------------|------------| | | management amongst middle management. | **34.2** Consult BROs on what has worked/not worked for them in their areas when providing guidance to managers. | | | | managers and staff on our responsibilities as individuals for saving records we create and as managers for directing how and where records are to be kept on each work stream/policy area. | | | R35 | The Department should develop a knowledge capture policy to ensure knowledge is not lost when staff leave the organisation. | **35.1** Develop process and guidance for managers to use to capture knowledge from departees | High | In 2010-11 | Knowledge & Information Management Division | This is a key area of concern to be addressed in implementation of the KIM strategy recently approved. | | | R36 | The Department should develop a programme to raise awareness of the risks of poor information management, to reinforce and embed good practice. | **36.1** Include clear Messages on risks in Better RM project and subsequent steps in the Data handling Culture Change work stream. | High | In 2010-11 | Knowledge & Information Management Division | The Better RM project is our initial vehicle and complementary messages will be included in the mandatory Protecting Information refresher training in 2010 and as part of our wider KIM programme over the next two years. | |

Signed: \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_ \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_ \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_ Department IMA Team Information Management Consultant